3e459ddacb185e3f23302f86d525c7374d4ed3a5a805597badc4a05eb528d16b

Analysis

max time kernel
499s
max time network
600s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
27/10/2026, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LiquidIsland-2.0.0.apk
Size 4.7MB
Sample261027-elwpwabs9m
SHA256 3e459ddacb185e3f23302f86d525c7374d4ed3a5a805597badc4a05eb528d16b
MD5 00dc95f0da618683603f186f48351805
SHA1 3361cc57948292d7505eabe91e43362c23f4f0ed
SHA512 22bee3737b957cfb0febe7acc2e9efcd025f3e9a3a35e2f7fda87aada5227642b7bca8570b14dbb4e5be043e7aee3a40c80dd09d9659a66f43459c767bd72a57
SSDEEP 98304:KG7pE3ydPV4DYRb30uWOhTjEwrbnU4YVad9bT6iQSBVhaJ5lDGYe:T7yiXAufhbhY0VmiQSBVh6bxe
TLSH
T1C4361115BA897C6FC833C1369D46D665642ADC6A9F93C707B0243B3D24BB3E48F192E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.example.liquidisland
/system/xbin/su	com.example.liquidisland

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/apex/com.android.art/javalib/core-oj.jar	4761	com.example.liquidisland

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.liquidisland

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.liquidisland

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.example.liquidisland

Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.example.liquidisland

com.example.liquidisland
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4761

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

core-oj.jar

Path /apex/com.android.art/javalib/core-oj.jar
Size 4.7MB
SHA256 4df590b764f65c16b51176ff394458d0b3a866ca75a4f912d6f76b7793043c1c
MD5 17bf082d9e9a6eb8b5d62d82f4af5476
SHA1 a401c7fbd8feea319dbcece5b4b3f6a254e71fb3
SHA512 f1a2673bf5c478176de0fceec8419434ab0606a14343c3b7fe1e2b181b0a2ff8f00c888ea1dcb8e711c4eb14aa1294919440adc63ce7735a67e93da21a0f7ae7
SSDEEP 49152:rCaT/d/A6u6uT79YDz6beFEFNg40GwckDgO/Zzz2+gCq6gVpNkypHde:eay6279o4eFrGwLetPe
TLSH
T1FB369E02DD978E77D0BC833BC8F70B65ABB2D59877030753000AA7746E87BD6AE92165
MD5 SHA1 SHA512 SSDEEP TLSH

Download

com.google.android.datatransport.events

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events
Size 56KB
SHA256 7760d1ebee896dbd8cbd7f51899cc8d0059d055d0de9ec3e32fc02fad27e15c5
MD5 b58435ccde1f557c3bc44aa286837837
SHA1 8f41b522ee017b521990a43f6b3a3725e204a95e
SHA512 5520c06af81b8c9239e8d4755e73fd85e234cff2c6c9978cb5f4265042939357b38ec594699c04dbe3f91fed5e37b4df4b49c01ef568cbe30098e64ebfac5f65
SSDEEP 96:7AMEX0wIyNjaH/IEEQrBoB9HbGpZbbjbY:cjswrQrObHi7b/bY
TLSH
T1AF43FA4EAB3C3531C27CB53DE7E147632F7C53CF5762912035E88DE44E850A978261A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 b79facad1f086ebcdc0cf10e264b42f28b7b139db48b30da775d8eafcf0d5040
MD5 102a6fc348cfcbaee077c0ff0c740bbc
SHA1 cd21bdf44628dd10db0b9d42d073b384426456b5
SHA512 935e21b4b5db307d89182b05806a90b7de5e704c68070396c26d98a8bd72ddf791b97f002c017165cd19ad3276d287afab3e6d89dc731a0c79d39451071ca27b
SSDEEP 48:7Megaq/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSw:7nga0AMEX0wIyNjaw
TLSH
T156B24E5D193C2321C6BE283ED7E202535A7C53DF572391703EA49CEA8DC256AB0254AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 d027272c1034911ccdba3b3befd726af7211e3ea581784da8d7b37aaa07b581f
MD5 a554f0735a428479650e5e6d0f161f98
SHA1 2ba5040ec10d45b49b9a933b7bda2d261864453d
SHA512 7ae6f63dce1d27bbf1634754b0cb8c80db3ce8087c1c8fb88be3e18665a0fd274e2167bfcb7a22b837a58e75ec8582a789720d5427ad225545be028d70b77525
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 4ac8cae25ad347bf249f5d599e326068eab25440d6fa40908f592d36ead133ca
MD5 29a0d3178a5b6bea500d950c3d04e584
SHA1 c30e6dd79c228c27a979c66fb0e4d9e82642c5be
SHA512 a2d30e51ee2757901b58162b0ee27b47e0c84e66bfb3bf4bd70c9c6c3ffab9b78c56d17c91e567ab1cddfadceeec12d380284572f6018ade914f702e0784a719
SSDEEP 6:7+/l9U8lFn1c/+Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKpn:7+txSRqLiuWdYRmBEyPban
TLSH
T1E502228863800822C82A97B790D8C3400D00AB298171CB171AA008942C0FBCCA4B0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.example.liquidisland/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b648f8b91600f2aaaaf2fdbdbfcd53ad6fc3574a411dac31446d1d76fb1682a4
MD5 9f1b85de6c07e0dc1874e16ba8829d31
SHA1 c9da915c66cb165814dc86ca1bdcdc72fcf3bac6
SHA512 7ccd400dfcfa2f84549f27f537f8689442c5ac30192a46a315e609ca054d62abd05b2b29ebfb99d18cc598e06a3572e1cea68851bf42144ad89073623431a83f
SSDEEP 6:7+/l9YugPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKmjdM/1:7+tx4qLJdeWRmBEyPbX5s1
TLSH
T198021289E7810A13C56D57BBA0D993541E14A72ED373CB57169208546C46BDCA8A0D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 97cb02da965fe288014fb420f57f8dfe260a065945edffd77af20a2f419984fb
MD5 3a30613963fbc61e03be98d809e38dc4
SHA1 e9e1e6660a8d02340b936ac4dd591f54df505b47
SHA512 a60b4818fe4f56ca81c524b8e99cab9b9ec155c16a60b2feb192aedd19b2740e0951d4939d8d7141de8e220ed1887b5a2618bb1c67114cae13091e238eb58892
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqNsvuoVNs3:TLWuEmO9zmzrfRmBEyPbB93k3
TLSH
T11A72C2CEDF102602C1760636F8CA93A55E64E22D8336EA472B950460AD42449A8A1F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 8bc58ec0ac0930215aa6eb86dd3f9d3baddf04d1e775458209e2e189e64b12f8
MD5 828bd2560d2154bb74771ba848da9fa9
SHA1 e6d4f9b126bd9e01c1e14e6428543e5fb4a483b6
SHA512 8575d501763ad4b186acb3e777c3d07231a768d2aca629c8ad366b199fe2910b0d618d2af2c2bd8ba308b5ea0b1e54196c42bd0907be615b4c2b7df455832365
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6X:TLiEq9zmzrfRmBEyPbP/P+/0Fl6jH7
TLSH
T1D77268CCBB106703D277477670CB93E11C34A2198733DA073B490464AC421C59042F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 61d79cffbe02d190f21aa3b8170374da78f5b082993d8c7ea3bd2191fc8ded49
MD5 36ab304a88adb1b3edb0c2536a2805b4
SHA1 bb7c7471c3fff399fb4938ca53c5bf52d72fc101
SHA512 8531376dd1ef74028307a5e297ea4a63ce33f3807a99ad827eaccd49c5b624583c0a3e8016b38aa2b64e5d646404db5bd32639aacdf7e71a54720cd02a623606
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlU1mJ+/0Fl6jH7:TLopmzr0GSP/h1499F61ylFmb
TLSH
T12A725299BA209707E7374B3560CBE3D12C3872269B23D6077A0A1A2C6D823C68022F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 44d9d113fa3195def9271f2ffa85cba43a8635f4efcf89328a6607daf7f5aef5
MD5 3edac914a13e3458cf67f3447189fd8b
SHA1 567790fafa32eac21f9a3b412e0cc6e55dbba4d6
SHA512 42d58802f9b9f45634056d46e40d3c9bf7e9e57ec2a6a253ee55196d43497e5f4dc79f04d40e6c6c24da20028cb53310e1b2babfc0bf3eae5952bd35d5a67be1
SSDEEP 24:TLYpmzr0GSP/JKabCCb63R499F61ylFmb:TcArSP/kabCCb9568mb
TLSH
T1307226D8B564D707F67B4B3961CBE7D1383872A75B27D6133D0A2B1C6D423828121B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 baab8b0818f58ad06c3d1adb2a4da9ea5756b02850a3f554b57e203afbdda7bd
MD5 d6050d66a66af3b9dcad3085550598af
SHA1 3e22e29b1352b59d9a0015e6139a330ca4bdd251
SHA512 ee0797bec5b22b10204201b61307ab591c41789d8d3acd3961537f955e3fa923377f6f8d7502e8ffb8e0c549e4d16ea8c20f0bba61e80c8350838f2b2000c624
SSDEEP 24:TL6vpmzr0GSP/uKabCCb63R499F61ylFmP:T2vArSP/7abCCb9568mP
TLSH
T1BE7226D8B674DB03F6774B3961C7E7C1383972A74727DA17390A2B1C6C423828021B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.example.liquidisland/databases/google_app_measurement_local.db
Size 16KB
SHA256 b4765a86f69c122307448d0c6e81cebd52ffbc59b0d19da42971e2857f773e6d
MD5 818548be1885386cc995f564f36a8e8e
SHA1 008b0c602ed55b1122dadfb3a20db517d55c10b3
SHA512 47840561a1eded73600b656576a7a9195bd1beddb79b08090b9e6bd9ab610de6cfb0a334310bfefe0b33ef157d420aaa17c6315fa2e689398da3328c4460a02f
SSDEEP 6:l9bNFlgls1WnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TLuEe9zmzrfRmBEyPbP/WK
TLSH
T128722BCD9F102603C5730777B4CEA3916E14622D83379E472BD90570AE834899051F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download